Iranian Hackers Pose as Recruiters to Spread Malware via Coding Tests
New Node.js-based malware targets Linux and macOS systems through sophisticated attacks.
1New Malware Families
The Iranian-linked Nimbus Manticore hacking group is using two new malware families called NodeRabbit and PollCat, developed with Node.js and JavaScript. These tools expand the group's capability to target Linux and Apple macOS systems. Discovered by Russian cybersecurity firm Kaspersky, the malware specifically targets software engineers through sophisticated social engineering tactics.
2Recruitment-Themed Lures
The hackers pose as talent acquisition specialists on LinkedIn and other job platforms, sending targets trojanized coding challenges. A ZIP file named 'Front-Technical-Challenge.zip' hosted on AWS is presented as coming from a major tech company. Targets are asked to fix a frontend bug within 3 hours without using AI-assisted tools, while the real threat hides in the server component.
3Hidden in Plain Sight
Victims are instructed not to modify the 'server.js' file, claimed to be 'bug-free and functioning correctly.' However, this file contains the malicious payload. Its first line imports a trojanized npm package called 'colorized_terminal' version 2.1.0. This package silently executes NodeRabbit malware in the background from a hidden cache location, establishing communication with command servers.
4NodeRabbit's Capabilities
NodeRabbit communicates with three different Azure-based command-and-control servers. Equipped with 11 commands, the malware can gather system information, execute shell commands, perform file operations, and modify network settings. It can also write Base64-encoded Node.js scripts to temporary files, execute them, and then delete them to cover its tracks - demonstrating advanced evasion techniques.
5Persistence Mechanisms
The malware employs different persistence mechanisms based on the operating system: Windows registry keys for Windows, cron jobs for Linux, and launch agents for macOS. Some variants impersonate legitimate software like Microsoft Edge updates or Intel Driver Support Assistant. It even creates daily scheduled tasks for systems using Windows Subsystem for Linux (WSL), showing cross-platform adaptability.
6PollCat Distribution Method
Nimbus Manticore distributes PollCat through time-limited coding challenges named 'RankChallenge-react-6uJSX3-main.zip.' The project uses CTF (Capture The Flag) terminology throughout, despite not being a security challenge. Targets are pressured to enter an attacker-supplied 6-digit OTP that refreshes every 30 seconds, creating artificial urgency to increase infection rates.
7AI-Generated Code Suspicion
Kaspersky researchers suggest the React platform used to deliver PollCat may have been generated by AI coding assistants. Inconsistent instructions and repetitive CTF labels point to template-based generation. The attackers likely used AI to create a CTF-style React platform and later inserted malicious components, showcasing how emerging technologies are being weaponized in cyber operations.
8Industry-Wide Implications
Nimbus Manticore's new techniques pose significant risks to software developers and tech professionals. The group's adoption of recruitment-themed lures mirrors tactics long used by North Korea's Lazarus Group, proving their effectiveness. Organizations must enhance employee awareness about external technical tests and review security protocols, especially regarding third-party code execution and development environment security.